Programming Leftovers

posted by Roy Schestowitz on Aug 05, 2026

• Unmitigated Risk ☛ From Chains to Trees

  This is not merely a cryptographic migration. It is the ecosystem cashing in a forced upgrade to close a decade-old compromise in Certificate Transparency. Transparency stops being a post-issuance promise and becomes the issuance mechanism itself. The wire format changes. Most of the governance carries forward.

• Himanshu Anand ☛ Two Parsers, One JSON and a Flag: Intigriti's July 2026 Challenge

  Intigriti’s July challenge is called “Canonically Yours” and the whole bug is one silly question: what happens when you put the same key in a JSON object twice? Turns out two different bits of code answer that differently and that gap give you the flag.

• Eric Bailey ☛ Here’s yet another metaphor about tech debt

  The city next to the town I grew up in had a shopping center that was built atop a sanitary landfill.

  For those unfamiliar, creating a sanitary landfill involves taking landfill waste, spreading it into thin layers, compacting it, then paving over it. It enjoyed popularity as a practice in the 60s and 70s.

• Cory Dransfeldt ☛ Farewell Cadence

  Cadence was the first native app I'd authored in years and was an interesting challenge. Navidrome's support of the Subsonic API is well documented and clear. But streaming and dealing with audio is not easy. It likely wasn't the best choice of app to dive back in with, but I learned a lot.

• Artem Novichkov ☛ Using SwiftUI’s ContentBuilder with Non-View Types

  SwiftUI's result-builder syntax is usually associated with views. When I used the same language feature to compose action sheets, I had to declare a custom @resultBuilder and implement every form of control flow the API needed.

  The Xcode 27 SDK changes that. @ContentBuilder can assemble values that don't conform to View. We'll use it to build a type-safe deep-link router, then preserve the same syntax for earlier deployment targets.

  The key idea is simple: instead of teaching a new builder how to combine routes, we'll teach SwiftUI's containers how to route.

• Ata Kuyumcu ☛ Tests for a PDF

  Four checks that describe a file, one that describes the document and doesn’t run, one grep for a font, and a template full of defensive settings against a reader I have never observed. Put like that it’s not a great scoreboard.

  But the 200-character check is still the one I’d keep if I could only keep one, and it’s still the one most likely to fire, because “the text layer broke” is a thing that actually happens to PDFs and it’s invisible on screen. The rest is me guessing at what a parser wants and occasionally, as with the ligatures, being able to prove I guessed wrong and doing it anyway.

• Hisham ☛ The Lua community needs to learn to move on

  If Roberto and Mike are EOLing the interpreters, maybe we should be doing the same for the libraries. If people really want to be using very very old versions of Lua, they should be using very very old versions of the supporting ecosystem as well, and not forcing maintainers into supporting 20+ years of legacy at all times.

• Pandoc ☛ twenty years of pandoc

  People often ask: Why is pandoc written in Haskell? There could have been good answers to this question: Haskell is a very good language for writing this kind of application. But in fact, I didn’t decide to write a document converter, then decide to use Haskell for it. I decided to use Haskell, and then decided to write a document converter in it.

  I had heard about Haskell from the blog of a philosophical logician friend, Greg Restall. Of an introductory book on Haskell, he said: “I’m glad that this wasn’t the textbook in my introductory computer science course, long ago in 1986. If it were, I may have fallen in love with computing and never become a philosopher”

• R / R-Script

  • Rlang ☛ R GUI Comparison Update

    Graphical user interfaces for the R language are easy to use and getting more powerful all the time. Here is my updated comparison of jamovi, JASP, BlueSky Statistics (free & Pro), Rattle, RKWard, R-Instat, R AnalyticFlow, and R Commander.

    With so many detailed reviews of Graphical User Interfaces (GUIs) for R available, which should you choose? It’s not too difficult to rate them based on the number of features they offer, so I’ll start there. Then, I’ll follow with a brief overview of each.

• Python

  • Juha-Matti Santala ☛ C is for command line interfaces - Python A to Z

    Python is a great language for writing scripts that are executed from the command line. I’m a big fan of command line interfaces and love building them for all sorts of needs both personally and when I’m part of a team.

  • Menno Finlay-Smits ☛ Projects I Wouldn't Use Python For in 2026

    This talk starts with my early adoption of Python and the subsequent decades of using it for almost everything. It then moves into why Python isn't always the best choice and what I now often use instead. I still love Python though and the presentation finishes with where I think Python still shines.

• Shell/Bash/Zsh/Ksh

  • Adam Johnson ☛ Zsh: list recently modified files with (m0) glob qualifiers

    My downloads directory is a junk pile that I just never get around to fully clearing. So if I’ve just downloaded a bunch of files, I normally want to work with them and ignore the rest of the files.

    To do this, I’ve found it convenient to have Zsh select recently modified files with glob qualifiers, the extra syntax you can add to filename globs.

• Java/Golang

  • Kevin McDonald ☛ The CPU Cost of Protobuf Varints in Go

    When you define an integer field in a Protocol Buffers schema, int64 is a common default. Varint encoding compresses small numbers into a byte or two, keeping network payloads lean.

    However, that compression comes at the cost of CPU cycles. To read or write a varint, the CPU must process the value byte by byte, checking continuation bits and shifting payloads. When a field sits in a high-throughput backend service, CPU efficiency often matters far more than saving a few wire bytes.

• Rust

  • Tor ☛ Arti 2.5.1 released | The Tor Project

    Arti is our ongoing project to create a next-generation Tor implementation in Rust. We're happy to announce the latest release, Arti 2.5.1.